Google SecOps Detection Coverage Evaluator
Trace threat intelligence through coverage testing and reviewed rule creation in Google SecOps.
The skill requires user approval before creating rules and describes the flow from blog text through TDOs and synthetic UDM events to SecOps deployment. It does not define least-privilege permissions, sensitive-threat-data handling, credential isolation, deployment rollback, or rule removal/reversal, so points are deducted.
The sequence, full TDO/UDM loops, and tool calls are reasonably explicit. However, SecOps MCP dependencies are assumed, and input validation, exception branches, retries, partial-failure recovery, and diagnosable error handling are missing. With static review and no test evidence, the score is capped below 10.
The intended audience and scenarios are fairly clear, and threat hunting and SOC investigative actions are explicitly excluded. Trigger boundaries, prerequisites, MCP availability, mainland-China network reachability, Chinese-language support, and behavior for malformed or unsuitable blog content are not specified.
The documentation includes metadata, staged workflow instructions, an output schema, tool references, and repository-level installation guidance. The repository also supplies an Apache-2.0 license, contribution guidance, support path, and an active-development note. The skill lacks its own versioning, changelog, explicit maintainer/update path, dependency setup, examples, and troubleshooting guidance.
The workflow covers intelligence extraction, TDO generation, synthetic events, coverage evaluation, rule generation, and approval-gated deployment, so the core value proposition is plausible. Correctness, tool behavior, generated-rule quality, and comparative benefit over manual work lack file-contained execution evidence; outputs still require review, so the static score is capped at 7.
The files provide auditable workflow steps, tool names, parameter constraints, and an output structure. There is no committed test suite, CI coverage, fixed fixture, or third-party execution evidence, leaving limited corroboration of key claims.
- Creating rules changes the external SecOps environment; obtain per-rule confirmation and verify the target project, permission scope, and rollback procedure before execution.
- Do not send unsanitized threat intelligence, UDM data, or rule content to unreviewed external services; the skill does not specify retention, access control, or sensitive-field handling.
- Confirm that the required SecOps MCP tools, credentials, and regional network access are available, and define manual handling for tool failures, empty results, and invalid JSON.
What does this skill do, and when should you use it?
This skill supports an end-to-end detection engineering workflow for Google SecOps. It extracts threat intelligence from a blog URL, generates Threat Detection Opportunities, and creates synthetic UDM events for each opportunity. It then evaluates existing rule coverage, checks whether matching rules are enabled and alerting, and generates YARA-L 2.0 rules for gaps. Creating new rules requires user approval and a configured SecOps MCP server.
Extracts the complete blog text from a supplied URL; calls Google SecOps MCP tools to generate Threat Detection Opportunities; generates synthetic UDM events for every TDO; evaluates each event against existing rules; checks the enabled and alerting_enabled status of matched rules; generates YARA-L 2.0 rules for coverage gaps; produces a structured summary of TDOs, coverage, gaps, and errors; and, after approval, calls create_rule to add approved rules.
- A security engineer wants to identify detectable attacker behaviors from a threat-intelligence blog.
- A SecOps team needs to validate existing detection coverage with synthetic UDM events.
- A detection engineer needs to verify whether matched rules are enabled and configured for alerting.
- A security team has coverage gaps and wants YARA-L 2.0 rules generated for the relevant TDOs.
- A SecOps administrator wants to create reviewed rules in Google SecOps after per-rule approval.
What are this skill's strengths and limitations?
- Covers the workflow from threat-intelligence extraction through reviewed rule creation.
- Explicitly processes every TDO and every generated synthetic UDM event.
- Checks both rule enablement and alerting status.
- Keeps human control over rule creation through approval.
- Requires Google SecOps MCP tools and a configured SecOps MCP server.
- Rule creation is gated by user approval rather than being automatic.
- The source provides no test-suite, performance, or cross-platform validation evidence.
- It is explicitly out of scope for threat hunting and SOC investigations.
How do you install this skill?
Run npx skills add google/skills, then select the SecOps Detection Coverage Skill from the repository during installation. The source does not document a specific installation directory or additional runtime setup.
How do you use this skill?
In an environment with a configured Google SecOps MCP server, provide a threat-intelligence blog URL and request a coverage evaluation. Example: "Evaluate Google SecOps detection coverage for this blog URL, generate rules for gaps, and ask for my approval before creating each rule." Do not use this skill for threat hunting or SOC investigative actions.